sscp chpt_1
TRANSCRIPT
Access ControlSlide 1 of 71
Access ControlAccess ControlJames Moore
Information Security Operations, e^deltacomPresident, ISSA – Metro Atlanta
SSCP
Access ControlSlide 2 of 71
Overview• What is Access Control?• Basic Approach• Access Control Models• Authentication• TEMPEST• Watching the Door!• Iterative Methods Review• Quiz
Access ControlSlide 3 of 71
What is Access Control?
Access ControlSlide 4 of 71
What is access control?• Access control is the heart of security• Definitions:
– The ability to allow only authorized users, programs or processes system or resource access
– The granting or denying, according to a particular security model, of certain permissions to access a resource
– An entire set of procedures performed by hardware, software and administrators, to monitor access, identify users requesting access, record access attempts, and grant or deny access based on established rules.
Access ControlSlide 5 of 71
Access control nomenclature• Authentication
– Process through which one proves and verifies certain information• Identification
– Process through which one ascertains the identity of another person or entity
• Confidentiality– Protection of private data from unauthorized viewing
• Integrity – Data is not corrupted or modified in any unauthorized manner
• Availability– System is usable. Contrast with DoS.
Access ControlSlide 6 of 71
Key Terms• Subject –an active entity, usually in the
form of a person, process, or device that cause information to flow amongst objects.
• Object –a passive entity that contains or receives information usually in the form of a file, program, memory.
Access ControlSlide 7 of 71
Labels• Sensitivity Labels
– Every subject and object in a MAC has a sensitivity label. Each label has two parts:
• Classifications and Category (or compartment)– Classifications- Secret, Top Secret, Confidential
(hierarchical)– Category- Tank Specs, Payroll, Sales Projections
• Example:– James object sensitivity label: Secret– R&D compartment sensitivity label: Confidential
Access ControlSlide 8 of 71
How can AC be implemented?– Hardware– Software
•Application•Operating System•File System•Protocol
– Physical– Logical (policies)
Access ControlSlide 9 of 71
What does AC hope to protect?• Data - Unauthorized viewing, modification or copying• System - Unauthorized use, modification or denial of
service• It should be noted that nearly every network
operating system (NT, Unix, Vines, NetWare) is based on a secure physical infrastructure
Access ControlSlide 10 of 71
Orange Book• DoD Trusted Computer System Evaluation Criteria,
DoD 5200.28-STD, 1983• Provides the information needed to classify systems
(A,B,C,D), defining the degree of trust that may be placed in them
• For stand-alone systems only
Access ControlSlide 11 of 71
Orange book levels• A - Verified protection• B - MAC• C - DAC• D - Minimal security. Systems that have been evaluated, but
failed
Access ControlSlide 12 of 71
BASIC APPROACH
Access ControlSlide 13 of 71
Banners• Banners display at login or connection stating that
the system is for the exclusive use of authorized users and that their activity may be monitored
• Not foolproof, but a good start, especially from a legal perspective
• Make sure that the banner does not reveal system information, i.e., OS, version, hardware, etc.
Access ControlSlide 14 of 71
Rule of least privilege• One of the most fundamental principles of infosec• States that: Any object (user, administrator, program,
system) should have only the least privileges the object needs to perform its assigned task, and no more.
• An AC system that grants users only those rights necessary for them to perform their work
• Limits exposure to attacks and the damage an attack can cause
• Physical security example: car ignition key vs. door key
Access ControlSlide 15 of 71
Implementing least privilege• Ensure that only a minimal set of users have root
access• Don’t make a program run setuid to root if not
needed. Rather, make file group-writable to some group and make the program run setgid to that group, rather than setuid to root
• Don’t run insecure programs on the firewall or other trusted host
Access ControlSlide 16 of 71
Multi-factor authentication• 2-factor authentication. To increase the level of
security, many systems will require a user to provide 2 of the 3 types of authentication.• ATM card + PIN• Credit card + signature• PIN + fingerprint• Username + Password (NetWare, Unix, NT default)
• 3-factor authentication -- For highest security• Username + Password + Fingerprint• Username + Passcode + SecurID token
Access ControlSlide 17 of 71
Proactive access control• Awareness training• Background checks• Separation of duties• Split knowledge• Policies• Data classification• Effective user registration• Termination procedures• Change control procedures
Access ControlSlide 18 of 71
AC & privacy issues• Expectation of privacy• Policies• Monitoring activity, Internet usage, e-mail• Login banners should detail expectations of privacy
and state levels of monitoring
Access ControlSlide 19 of 71
System Accountability• Requires system to provide for at least the following:
– The ability to audit transactions– Control access through authentication– Provide effective identification
Access ControlSlide 20 of 71
Access Control Models
Access ControlSlide 21 of 71
Varied types of Access Control • Discretionary (DAC)
– The users/object decides the access• Mandatory (MAC)
– The systems decides the access• Non-Discretionary (Lattice/Role/Task)
– The role determines access• Formal models:
– Biba– Clark/Wilson– Bell/LaPadula
Access ControlSlide 22 of 71
Biba• The Biba Model• The Biba model addresses the issue of integrity, i.e.
whether information can become corrupted. A new label is used to gauge integrity. If a high security object comes into contact with a low-level information, or be handled by a low-level program, the integrity level can be downgraded. For instance, if one used an insecure program to view a secure document, the program might corrupt the document, append it, truncate it, or even covertly communicate it to another part of the system.
Access ControlSlide 23 of 71
Clark Wilson• Clark and Wilson have also created a model which includes an
attention to data integrity. • Data objects can only be manipulated by a certain set of programs.
Users have access to the programs rather than to the data. (e.g. this is like the WWW or a database).
• Separation of duties: assigning different roles to different users. For instance, think of the dual-key approach to arming nuclear warheads.
• Objects/data can only be accessed by authorized programs (ensures integrity).
• Subjects/users only have access to certain programs. • An audit log is maintained over external transactions. • The system must be certified in order for it to work.
Access ControlSlide 24 of 71
Bell LaPudla• This is a formal description of a system with static
access control, i.e. privacy. It tells us nothing about integrity or trust.
• Used set theory to define the concept of a secure state, the modes of access, and the rules for granting access. BLP Unix
Subjects (S) UID/UsernameGID/Groups
Objects (O)Filesprocessesmemory segments
Access rights (M)ReadWriteExecute
Security levels (L)
AllowedDisallowedSetuidSetgid
Access ControlSlide 25 of 71
Problems with formal models• Based on a static infrastructure• Defined and succinct policies• These do not work in corporate systems which are
extremely dynamic and constantly changing• None of the previous models deals with:
– Viruses/active content– Trojan horses– firewalls
• Limited documentation on how to build these systems
Access ControlSlide 26 of 71
MAC vs. DAC• Discretionary Access Control
– Individuals decide how information assets are protected and share your data
• Mandatory Access Control– The system decided how the data will be shared
Access ControlSlide 27 of 71
Mandatory Access Control
• Assigns sensitivity levels, AKA labels• Every object is given a sensitivity label & is accessible
only to users who are cleared up to that particular level.• Only the administrators, not object owners, make change
the object level• Generally more secure than DAC• Orange book B-level• Used in systems where security is critical, i.e., military• Hard to program for and configure & implement
Access ControlSlide 28 of 71
Mandatory Access Control (Continued)
• Downgrade in performance• Relies on the system to control access• Example: If a file is classified as confidential, MAC
will prevent anyone from writing secret or top secret information into that file.
• All output, i.e., print jobs, floppies, other magnetic media must have be labeled as to the sensitivity level
Access ControlSlide 29 of 71
Discretionary Access Control• Access is restricted based on the authorization
granted to the user• Orange book C-level• Prime use to to separate and protect users from
unauthorized data• Used by Unix, NT, NetWare, Linux, Vines, etc.• Relies on the object owner to control access
Access ControlSlide 30 of 71
Access control lists (ACL)• A file used by the access control system to determine
who may access what programs and files, in what method and at what time
• Different operating systems have different ACL terms• Types of access:
– Read/Write/Create/Execute/Modify/Delete/Rename
Access ControlSlide 31 of 71
Standard UNIX file permissionsPermission Allowed action, if
object is a file Allow action if object is a
directory R (read) Reads contents of a file List contents of the directory X (execute) Execute file as a program Search the directory W (write) Change file contents Add, rename, create files and
subdirectories
Access ControlSlide 32 of 71
Standard NT file permissionsPermission Allowed action, if
object is a file Allow action if object is a
directory No access None None List N/A RX Read RX RX Add N/A WX Add & Read N/A RWX Change RWXD RWXD Full Control All All R- Read X - Execute W - Write D - Delete
Access ControlSlide 33 of 71
Physical access control• Guards• Locks• Mantraps• ID badges• CCTV, sensors, alarms• Biometrics• Fences - the higher the voltage the better• Card-key and tokens• Guard dogs
Access ControlSlide 34 of 71
Object reuse• Must ensure that magnetic media must not have any
remnants of previous data• Also applies to buffers, cache and other memory
allocation• Required at TCSEC B2/B3/A1 level• Objects must be declassified• Magnetic media must be degaussed or have secure
overwrites
Access ControlSlide 35 of 71
Authentication
Access ControlSlide 36 of 71
Authentication3 types of authentication:
Something you know - Password, PIN, mother’s maiden name, passcode, fraternity chantSomething you have - ATM card, smart card, token, key, ID Badge, driver license, passportSomething you are - Fingerprint, voice scan, iris scan, retina scan, body odor, DNA
Access ControlSlide 37 of 71
Problems with passwordsInsecure - Given the choice, people will choose easily remembered and hence easily guessed passwords such as names of relatives, pets,phone numbers, birthdays, hobbies, etc.Easily broken - Programs such as crack, SmartPass, PWDUMP, NTCrack& l0phtcrack can easily decrypt Unix, NetWare & NT passwords.
Dictionary attacks are only feasible because users choose easily guessed passwords!
Inconvenient - In an attempt to improve security, organizations often issue users with computer-generated passwords that are difficult, if not impossible to rememberRepudiable - Unlike a written signature, when a transaction is signed with only a password, there is no real proof as to the identity of the individual that made the transaction
Access ControlSlide 38 of 71
Classic password rules• The best passwords are those that are both easy to
remember and hard to crack using a dictionary attack. The best way to create passwords that fulfill both criteria is to use two small unrelated words or phonemes, ideally with a special character or number. Good examples would be hex7goop or -typetin
• Don’t use: – common names, DOB, spouse, phone #, etc.– word found in dictionaries – password as a password– systems defaults
Access ControlSlide 39 of 71
Password management• Configure system to use string passwords• Set password time and lengths limits• Limit unsuccessful logins• Limit concurrent connections• Enabled auditing• How policies for password resets and changes• Use last login dates in banners
Access ControlSlide 40 of 71
Password Attacks• Brute force
– l0phtcrack• Dictionary
– Crack– John the Ripper– for a comprehensive listing, see Alan Lustiger or attend
his presentation at the CSI conference in November• Trojan horse login program
Access ControlSlide 41 of 71
Biometrics• Authenticating a user via human characteristics• Using measurable physical characteristics of a person
to prove their identification– Fingerprint– signature dynamics– Iris– retina– voice– face– DNA, blood
Access ControlSlide 42 of 71
Biometric Disadvantages• Still relatively expensive per user- most expensive,
but also most secure• Companies & products are often new & immature• No common API or other standard• Some hesitancy for user acceptance
Access ControlSlide 43 of 71
Biometric privacy issuesTracking and surveillance - Ultimately, the ability to track a person's movement from hour to hourAnonymity - Biometric links to databases could dissolve much of our anonymity when we travel and access servicesProfiling - Compilation of transaction data about a particular person that creates a picture of that person's travels, preferences, affiliations or beliefs
Access ControlSlide 44 of 71
Practical biometric applications• Network access control• Staff time and attendance tracking• Authorizing financial transactions• Government benefits distribution (Social Security, welfare, etc.)• Verifying identities at point of sale • Using in conjunction with ATM , credit or smart cards • Controlling physical access to office buildings or homes • Protecting personal property• Prevent against kidnapping in schools, play areas, etc.• Protecting children from fatal gun accidents• Voting/passports/visas & immigration
Access ControlSlide 45 of 71
Tokens• Used to facilitate one-time passwords• Physical card• SecurID• S/Key• Smart card• Access token
Access ControlSlide 46 of 71
Authentication in the
Enterprise
Access ControlSlide 47 of 71
Single sign-on• User has one password for all enterprise systems and
applications• That way, one strong password can be remembered
and used• All of a users accounts can be quickly created on
hire, deleted on dismissal• Hard to implement and get working• Kerberos, CA-Unicenter, Memco Proxima, IntelliSoft
SnareWorks, Tivoli Global Sign-On, x.509
Access ControlSlide 48 of 71
Kerberos• Part of MIT’s Project Athena• Kerberos is an authentication protocol used for
network wide authentication• All software must be kerberized• Tickets, authenticators, key distribution center (KDC)• Divided into realms
Access ControlSlide 49 of 71
Kerberos roles• KDC divided into Authentication Server & Ticket
Granting Server (TGS)• Authentication Server - authentication the identities
of entities on the network• TGS - Generates unique session keys between two
parties. Parties then use these session keys for message encryption
Access ControlSlide 50 of 71
Kerberos authentication • User must have an account on the KDC• KDC must be a trusted server in a secured location• Shares a key with each user• When a user want to access a host or application, they
request a ticket from the KDC via klogin & generate an authenticator that validates the tickets
• User provides ticket and authenticator to the application, which processes them for validity and will then grant access.
Access ControlSlide 51 of 71
Problems with Kerberos• Each piece of software must be kerberized• Requires synchronized time clocks• Relies on UDP which is often blocked by many
firewalls
Access ControlSlide 52 of 71
RAS access control• RADIUS (Remote Authentication Dial-In User Service) -
client/server protocol & software that enables RAS to communicate with a central server to authenticate dial-in users & authorize their access to requested systems
• TACACS/TACACS+ (Terminal Access Controller Access Control System) - Authentication protocol that allows a RAS to forward a users logon password to an authentication server. TACACS is an unencrypted protocol and therefore less secure than the later TACACS+ and RADIUS protocols. A later version of TACACS is XTACACS (Extended TACACS).– May 1997 - TACACS and XTACACS are considered Cisco End-of-
Maintenance
Access ControlSlide 53 of 71
TEMPEST
Access ControlSlide 54 of 71
TEMPEST• Electromagnetic emanations from keyboards, cables,
printers, modems, monitors and all electronic equipment. With appropriate and sophisticated enough equipment, data can be readable at a few hundred yards.
• TEMPEST certified equipment, which encases the hardware into a tight, metal construct, shields the electromagnetic emanations
• TEMPEST hardware is extremely expensive and can only be serviced by certified technicians
• Rooms & buildings can be TEMPEST-certified • TEMPEST standards NACSEM 5100A NACSI 5004 are
classified documents
Access ControlSlide 55 of 71
Watching the Door
Access ControlSlide 56 of 71
Physical Security• Camera coverage
– Recoverable footage• Access controlled areas• Fences• Lights? (here’s a question….)
Access ControlSlide 57 of 71
Intrusion Detection Systems• IDS monitors system or network for attacks• IDS engine has a library and set of signatures that
identify an attack• Adds defense in depth
Access ControlSlide 58 of 71
Iterative Methodology
Review
Access ControlSlide 59 of 71
Penetration Testing / Vulnerability Assessments
• Basically Improving the Security of Your Site by Breaking Into it, by Dan Farmer/Wietse Venema
– http://www.fish.com/security/admin-guide-to-cracking.html
• Identifies weaknesses in Internet, Intranet, Extranet, and RAS technologies – Discovery and footprint analysis – Exploitation – Physical Security Assessment – Social Engineering
• Attempt to identify vulnerabilities and gain access to critical systems within organization
• Identifies and recommends corrective action for the systemic problems which may help propagate these vulnerabilities throughout an organization
• Assessments allow client to demonstrate the need for additional security resources, by translating exiting vulnerabilities into real life business risks
Access ControlSlide 60 of 71
Review Questions
Access ControlSlide 61 of 71
Review Questions• What is following is true about biometrics
a) Least expensive, least secureb) Most expensive, least securec) Most expensive, most secured) Least expensive, most secure
Answer: C) Most expensive, most secure
Access ControlSlide 62 of 71
Review Questions• Discretionary Access differs from Mandatory Access in the
following way:a) Is granted at the discretion of the system administratorb) Is only given to personnel who have demonstrated good
discretionc) Assigns access based on roled) Allows subjects to grant access to objects
Answer: d) Allows subjects to grant access to objects
Access ControlSlide 63 of 71
Review Questions• The three classic ways of authenticating yourself to the
computer security software are by something you know, by something you have, and by something a) you needb) non-trivialc) you ared) you can get
Answer: c) you are
Access ControlSlide 64 of 71
Review Questions• An access control policy for a bank teller is an
example of the implementation of a(n): you needa) rule-based policyb) identity-based policyc) user-based policyd) role-based policy
Answer: d) role-based policy
Access ControlSlide 65 of 71
Review Questions• A confidential number to verify a user's identity is called a
a) PINb) Useridc) Passwordd) challenge
Answer: a) PIN
Access ControlSlide 66 of 71
Review Questions• Which of the following is needed for System Accountability?
a) audit mechanismsb) documented design as laid out in the Common Criteriac) Authorizationd) Formal verification of system design
Answer: a) audit mechanisms
Access ControlSlide 67 of 71
Review Questions• Which of the following is true in a system with Mandatory
Access Control?a) the system determines which users or groups may access a
file.b) user can set up an access list for the file(s), and the system
checks both users and groups against this list before granting access.
c) a user can specify which groups of users can access their files, but the system determines group membership
d) no control is being enforce on this model
Answer: a) the system determines which users or groups may access a file.
Access ControlSlide 68 of 71
Review Questions• Which of the following is *not* needed for System
Accountability? a) Auditb) Authenticationc) Authorizationd) identification
Answer: a) audit mechanisms
Access ControlSlide 69 of 71
Review Questions• A potential problem with an iris pattern biometric system is:
a) concern that the laser beam may cause eye damageb) the iris pattern changes as a person grows olderc) there is a relatively high rate of false acceptsd) the optical unit must be positioned so that the sun does not
shine into the aperture
Answer: d) the optical unit must be positioned so that the sun does not shine into the aperture
Access ControlSlide 70 of 71
Review Questions• What is TEMPEST?
a) A really good movieb) Standards for controlling emanations from equipmentc) Tactical Electrical Modulation Emitting Surveillance
Teamd) The most secure method of Access Control
Answer: b) Standards for controlling emanations from equipment
Access ControlSlide 71 of 71
Any questions?• Homework for next week:
– CISSP Exam : Theory• Chapter 3• Pgs: 198-221, 226-237
– Computer Security Basics• Chapter 6
– Green and Brown books